Security audit log
Basic overview
The following page explains the different events that are logged when using the ‘Security audit log’.
A ‘Security audit log’ can be used to track relevant activities performed in Valsight.
The relevant files to activate the security audit log are located in the Valsight settings (navigation bar) → Metric and Logs → Download ‘Valsight Security Audit Log Files (ZIP)’.
What is logged?
Each event has the following aspects that are logged via the security audit log:
| Header | Description |
|---|---|
| Time | When the event occurred |
| User | The logged in user who caused the event |
| Object type | On what object type has the vent occurred (Group. User, Project, Model, …) |
| Object key | The exact object on which the event occurred |
| Project | The exact project in which the event occurred |
| Action type | Which event occurred |
| Action parameter1 | Additional info if all other headers aren’t enough |
| Action parameter2 | Additional info if all other headers aren’t enough |
| Action parameter3 | Additional info if all other headers aren’t enough |
Precise details about newly logged objects and what we log on them:
| Domain Object | Action Type | Detail |
|---|---|---|
| AssumptionGroup | Property change | Name |
| DataParameter | Deleted | Except when deleted by deleting a workspace, model or project |
| DataParameter | Property change | Everything except description |
| DataParameterVariant | Line-item data change | — |
| DataParameterVariant | Delete | Except when deleted by deleting a workspace, project or data parameter |
| Dimension | Created | — |
| Dimension | Deleted | Except when deleted by deleting a project |
| Dimension | Property change | Everything except description |
| ExternalDataSource | Deleted | Except when deleted by deleting a project |
| Level | Created | — |
| Level | Deleted | — |
| Level | Property change | Everything |
| Model | Property change | Only modelConfig changes are logged |
| Model | Deleted | Except when deleted by deleting a project |
| Node | Property change | Everything except description and displayConfig |
| PlanningWorkflow | Deleted | Except when deleted by deleting a project |
| ProjectVariable | Created | — |
| ProjectVariable | Property change | Both name and value |
| ProjectVariable | Deleted | Except when deleted by deleting a project |
| ScenarioExportTemplate | Deleted | Except when deleted by deleting a project |
| SimulationRun | Property change | The values name, baseline and parentSimulationRun |
| SimulationRun | Deleted | Except when deleted by deleting a project or workspace |
| SimulationRunVariable | Created | — |
| SimulationRunVariable | Property change | Includes the value of the original. This also logged when we create a variable override, to log the changes between the project’s and scenario’s values. |
| SimulationRunVariable | Deleted | Except when deleted by deleting a project, model, workspace or scenario |
| SimulationWorkspace | Property change | Everything in the simulationConfig |
| SimulationWorkspace | Deleted | Except when deleted by deleting a project |
| WorkflowStep | Deleted | Except when deleted by deleting a workflow or project |
Logged events
Add+Create/Remove+Delete/Change
| Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version |
|---|---|---|---|---|---|
| Adding permissions | Added permission | For which user/group is the permission added | — | — | Since beginning |
| Adding a role to the user or group | Added role | name of the role | — | — | Since beginning |
| Adding an user to a group | Added user to group | user | — | — | Since beginning |
| Creating an user or group | Created | ’preAuth’, ‘SAML’, ‘openIdConnect’ or no parameter | — | — | Since beginning |
| Create project variables | Created | ‘value’ | variable value | — | 5.8.0 |
| Update project variables | Property change | parameter type either ‘name’ or ‘value’ | parameter old value | parameter new value | 5.8.0 |
| Scenario variable | Created | — | — | — | 5.8.0 |
| Update scenario variable | Property change | ‘value’ | Value of project variable the scenario variable is overriding | scenario variable value | 5.8.0 |
| Delete scenario variable | Deleted | — | — | — | 5.8.0 |
| Dimension row added | Property change | dimRowAdded | name of each level and the value added to the level (including extended levels) | — | 5.8.0 |
| Removing permissions | Removed permission | For which user/group is the permission removed | — | — | Since beginning |
| Removing a role from the user or group | Removed role | name of the role | — | — | Since beginning |
| Removing user from the group | Removed user from the group | user | — | — | Since beginning |
| Deleting an user or group | Deleted | — | — | — | Since beginning |
| Node deletion | Deleted | names of the node, its model and project | — | — | 4.0.0 |
| Model deleted | Deleted | name of the model, name of the project space | — | — | 5.8.0 |
| Workspace deleted | Deleted | the name of the project space it belongs to | — | — | 5.8.0 |
| Data source deleted | Deleted | the name of the project space it belongs to | — | — | 5.8.0 |
| Workflow deleted | Deleted | the name of the project space it belongs to | — | — | 5.8.0 |
| Submission deleted | Deleted | the name of the project space it belongs to | — | — | 5.8.0 |
| Dimension deleted | Deleted | the name of the project space it belongs to | — | — | 5.8.0 |
| Templates deleted | Deleted | the name of the project space it belongs to | — | — | 5.8.0 |
| Project variable deleted | Deleted | — | — | — | 5.8.0 |
| Scenario variable deleted | Deleted | — | — | — | 5.8.0 |
| A line item variant is deleted | Deleted | data parameter variant’s key | — | — | 5.8.0 |
| Changing the project or application setting | Changed setting | A detailed description on which setting was changed, what was the previous value and what is the new value | — | — | Since beginning |
| Changing password of the user | Password changed | — | — | — | Since beginning |
| Changed data access permissions on a dimension or level (value) | Data permissions | — | — | — | 3.1.0 |
| Moving a node | Node changed models | old model | new model | — | 4.0.0 |
| A line item variant is updated | Line-item data change | — | — | — | 5.0.0 |
| A line item was selected or unselected from a scenario | Line item selection | ’selected’ or ‘unselected’ | parameter’s key | — | 3.1.0 |
| A line item variant is ‘selected’ or ‘unselected’ from being associated with a scenario | Line-item selection | ’selected’ or ‘unselected’ | data parameter variants’s key | — | 5.0.0 |
| User enabled or disabled | Property change | ’enabled’ | old value | new value | 3.7.0 |
Actions by users
| Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version |
|---|---|---|---|---|---|
| User creates, deletes or reverts a version | Versioning action | ’versioned’, ‘shared’, ‘unshared’, ‘deleted version’ or ‘reverted’ | optional: the created version or version you are reverting from | optional: workflow’s key if it was a submission | 3.1.0 |
| User links or unlinks levels | Object linking | ’extended’ or ‘extension removed’ | the key of the level that we extending by or removing extension to | — | 3.1.0 |
| User removes a value from a level | Property change | ’levelValueRemove’ | the value | — | 3.1.0 |
| User changes a value of a level | Property change | ’levelValueChange’ | the value | — | 3.1.0 |
| User change a parent value of a value | Property change | ’levelValueParentChange’ | the value | <old_parent> → <new_parent> | 3.1.0 |
| User renames an object | Property change | ’name’ | old name | new name | 3.1.0 |
| User changes a property on an object | Property change | name of the property | new value | — | 3.1.0 |
| User moves a line item from one group to another | Property change | ’movedFromGroup’ or ‘movedToGroup’ | the group | — | 3.1.0 |
| User does an action on a debug page | Special admin action | action name | HTTP method used | — | 3.1.0 |
| User logged in | User logged in | ’preAuth’, ‘SAML’, ’ openIdConnect’ or no parameter | — | — | Since beginning |
| User failed to login | Failed login | User that failed to login | empty or ”credentials OK - user blocked’ or ‘credentials OK - IP blocked’ | — | Since beginning |
| User uploads a file that may change a DS or dimension table | File upload | — | — | — | 3.1.0 |
| User downloaded log files | Log download | ’server.log’ or ‘securityAudit.csv’ | — | — | 3.1.0 |
| User was denied access to modify data | Data permissions write denied | Level value | Data permission class name | — | 3.8.8 |
| User performed an action that caused time dimension data to be regenerated | Time dimension change | [<start_date>…<end_date>]…Q<year_start_quarter> | — | — | 3.1.0 |
| User saved or discarded the workspace | Workspace save action | ’save’, ‘discard’, ‘saveAs’ | — | — | 3.1.0 |
| User changed data of a line item | Line item data change | — | — | — | 3.1.0 |
| User changed data of a line item variant | Line item data change | — | — | — | 5.0.0 |
| User changes line item name | Property change | ‘name’ | old name | new name | 5.0.0 |
| User changes line item slider minimum | Property change | ‘sliderMin’ | old value | new value | 5.8.0 |
| User changes line item slider maximum | Property change | ‘sliderMax’ | old value | new value | 5.8.0 |
| User changes line item slider step | Property change | ‘sliderStep’ | old value | new value | 5.8.0 |
| User created new API key | API key created | — | — | — | 3.6.0 |
| A user’s session ends either through an explicit logout or an inactivity timeout. NOTE: If the session ends to an inactivity logout it can take 30 - 40 minutes for it to be registered as having expired in the log. Thus the time of the log entry can not be seen as the time the session actually expired. | User logged out | Username of the user associated with the session | — | — | 5.8.0 |
| User changed the dimension table from a data source table | Property change | ‘dimensionTable’ | ‘autoDim’ | Audit key of the data source table | 5.8.0 |
Block events
| Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version |
|---|---|---|---|---|---|
| User blocked, due to too many unsuccessful consecutive logins | User blocked | ’unsuccessful logins’ | — | — | Since beginning |
| Blocked user manually unblocked | User unblocked | ’on boot’ or no parameter | — | — | Since beginning |
| Blocking IPs due to too many unsuccessful consecutive logins from the same IP | IP blocked | The blocked IP | — | — | Since beginning |
File export/import
| Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version |
|---|---|---|---|---|---|
| Chart exported | File export | ’Formatted export’ or ‘Raw export’ | — | — | 5.8.0 |
| Workspace Export | File export | ’Formatted export’ or ‘Raw export’ | — | — | 5.8.0 |
| Line item Download Excel | File Export | ’Data parameter download’ | DataParameter audit key | — | 5.8.0 |
| Assumption group Download Excel (a separate log line is made for each line item in the assumption group) | File Export | ’Assumption group download’ | AssumptionGroup audit key | — | 5.8.0 |
| Download excel for all assumption groups (a separate log line is made for each line item in each of the assumption groups) | File Export | ’Bulk workspace download’ | Workspace audit key | — | 5.8.0 |
| Node data preview download | File Export | Audit key of either the Baseline or SimulationRun associated with the data preview | — | — | 5.8.0 |
| Project export | File Export | — | — | — | 5.8.0 |
| Tampered project import | Tampered project import | Detailed reason, one of: Missing signature; Signature does not match content; Invalid signature | — | — | 6.0.0 |
Others
| Event | Action type | Action Parameter 1 | Action Parameter 2 | Action Parameter 3 | Added in Version |
|---|---|---|---|---|---|
| host header poisoning - The supplied host header is not included in the allowlist | Bad Host Header | Actual host header | — | — | 3.3.0 |
| Jdbc / Odata table import | External Datasource import | imported tables names | — | — | 4.0.0 |